Australian organisations are responding to a major global cybersecurity alert after AI-assisted research uncovered critical vulnerabilities in PHP, open-source programming language used by up to 70% of the world’s websites.

The vulnerabilities, known as PHP2Shell, have triggered emergency security updates and precautionary shutdowns of websites and services overseas. 

Website operators across the US and Europe have taken services offline while racing to protect systems from potential hacker attacks.

The flaws could allow attackers to execute malicious code remotely and take control of vulnerable servers, potentially exposing databases, sensitive information and connected systems.

Among those affected were government websites in Germany, France, Finland, Belgium and the Netherlands. The Wikimedia Foundation, which operates Wikipedia, also took some systems offline as a precaution, while hospitals, political organisations and the Port of Rotterdam were among Dutch organisations affected by the security response.

In Australia, authorities have urged organisations to prepare for, and apply, security fixes.

In a message to Australian customers, TPP said it had implemented additional safeguards across relevant systems as a precaution. 

The statement does not indicate that TPP has suffered a confirmed breach. However, the precautionary measures highlight how vulnerabilities in widely used software can affect Australian organisations and their customers.

The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) has issued a critical alert about the PHP vulnerabilities, warning organisations responsible for websites, applications and network infrastructure to take immediate preparatory action.

The agency has advised technical teams to identify PHP installations, monitor official security guidance, prepare to apply patches and watch for potentially malicious activity.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both have received severity scores of 9.2 out of 10 under the CVSS 4.0 system.

According to the ACSC’s initial advisory, all PHP versions from PHP 5 onwards may be affected. At the time of that alert, the agency said it was not aware of active exploitation related to the vulnerabilities. Cloudflare reported observing attack traffic targeting the flaws.

The ACSC has urged affected organisations to consult official PHP security guidance and act promptly as fixes become available.

PHP is an extensively used, open-source programming language used to build and operate dynamic websites and web applications. It is embedded in platforms including WordPress, Drupal and Joomla.

This means the vulnerabilities have the potential to affect a broad range of organisations, from small businesses and website operators to government agencies and large technology providers.

The central concern is remote code execution. Under certain conditions, an attacker could send requests to a vulnerable server and cause it to execute malicious code without first logging in.

Temporary security controls can reduce exposure, but they should not be assumed to replace a permanent software update.

For Australian businesses, this means confirming which systems rely on PHP, establishing whether hosting providers and software vendors have applied the relevant fixes, and checking that updates have taken effect. Organisations should also review security logs and investigate any unusual activity.

The discovery highlights the growing role of AI in cybersecurity, where the same technology can help identify weaknesses while potentially making it easier for attackers to exploit them.

Security researchers at Calif and Google’s cybersecurity business Wiz used AI-assisted tools to identify the PHP vulnerabilities. The research involved OpenAI’s GPT-5.6 Sol model, Google’s Gemini 4 Argon and Wiz’s autonomous vulnerability research platform, Wiz Atlas.

The findings were coordinated with PHP developers, allowing emergency patches to be prepared before public disclosure.

Researchers said AI can dramatically reduce the time and expertise typically required to identify and exploit complex software vulnerabilities. That creates a narrow window for organisations to secure systems before attackers catch up.

For businesses, the incident is a reminder that website security depends on more than firewalls and monitoring tools. Organisations must know which software their websites use, ensure hosting providers apply critical updates and have plans for responding to vulnerabilities .